The Delower WP To Do plugin for WordPress contains a stored XSS vulnerability (CWE-79) due to improper input sanitization during web page generation. This allows an attacker with low privileges and the ability to interact with the application to inject malicious scripts that execute in the context of other users. The vulnerability affects all versions up to 1.3.0. No official patch or remediation guidance has been published by the vendor as of the publication date.

Successful exploitation can lead to the execution of arbitrary scripts in the browsers of users who view the injected content, potentially resulting in information disclosure, session hijacking, or other client-side impacts. The vulnerability has a CVSS 3.1 base score of 6.5 (medium), reflecting the need for user interaction and low privileges but with potential confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting plugin usage to trusted users only and monitor for suspicious activity. Avoid granting unnecessary privileges to users who can input content into the plugin. No official patch or temporary fix is currently available.